A few command exec bypass tips

Some of the words

When executing commands against Linux targets, I found that some commands were somewhat limited, so I read many blogs and shared some command reference learning

Actual use

Tips1

It's so simple, I don't even have to describe it, do I

┌──(rootyangsirrr-github-io)-[~]
└─# a=`id`
                                                                                                                                        
┌──(root💀yangsirrr-github-io)-[~]
└─# echo $a
用户id=0(root) 组id=0(root) 组=0(root),141(kaboxer),142(docker)
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[~]
└─# echo ${a:1,5}
0(root) 组id=0(root) 组=0(root),141(kaboxer),142(docker)
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[~]
└─# echo ${a:1:5}
户id=0
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[~]
└─# echo ${a:1:10}
户id=0(root

Tips2

Combine it with an array and do it yourself

┌──(rootyangsirrr-github-io)-[/var/www]
└─# ls
html
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# b[1]=sudo
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# b[2]=touch
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# b[3]=yyy.txt
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# echo $b
sudo touch yyy.txt
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# ls
html
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# $($b)  

ls
sudo: 无法解析主机：yangsirrr-github-io: 未知的名称或服务
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# 
                                                                                                                                        
┌──(rootyangsirrr-github-io)-[/var/www]
└─# ls
html  yyy.txt

Tips3

Cut the existing command to get the space and combine it with the command we want to execute

root@y:~# a=`id`
root@y:~# b=${a//uid=0(root)/ls}
root@y:~# c=${b//gid=0(root)/-la}
root@y:~# d=${c//groups=0(root)/}
root@y:~# $d
total 68
drwx------  5 root root  4096 Jul  7 11:02 .
drwxr-xr-x 20 root root  4096 Jul  7 10:55 ..
-rw-------  1 root root   349 Aug 29 13:57 .bash_history
-rw-r--r--  1 root root  3106 Dec  5  2019 .bashrc
drwx------  3 root root  4096 Sep 14  2020 .cache
-rw-r--r--  1 root root 25977 May 15 14:12 install.sh
drwxr-xr-x  2 root root  4096 Sep 14  2020 .pip
-rw-r--r--  1 root root   161 Dec  5  2019 .profile
-rw-r--r--  1 root root   206 Jul  7 10:27 .pydistutils.cfg
drwx------  2 root root  4096 Sep 14  2020 .ssh
-rw-r--r--  1 root root   169 Jul  7 10:41 .wget-hsts